From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-hackers@lists.postgresql.org
cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Subject: Re: CVE-2017-7484-induced bugs, or,
 btree cmp functions are not leakproof?
In-reply-to: <3876.1531261875@sss.pgh.pa.us>
References: <3876.1531261875@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Tue, 10 Jul 2018 18:31:15 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <11559.1531349520.1@sss.pgh.pa.us>
Date: Wed, 11 Jul 2018 18:52:00 -0400
Message-ID: <11560.1531349520@sss.pgh.pa.us>
Precedence: bulk

I wrote:
> I propose to run through the system operator classes, find any for which
> the comparison function isn't marked leakproof but the operators are,
> and fix them.  This is clearly appropriate for HEAD and maybe it's not
> too late to force an initdb for v11 --- thoughts?

I did that for the built-in btree opclasses.  I decided that it's probably
not worth forcing an initdb in v11 for, though.  In principle, losing
selectivity estimates because of non-leakproof functions should only
happen in queries that are going to fail at runtime anyway.  The real
problem that ought to be addressed and perhaps back-patched is this:

> Another question that could be raised is why we are refusing to use
> stats for a child table when the caller has select on the parent.
> It's completely trivial to extract data from a child table if you
> have select on the parent, so it seems like we are checking the
> wrong table's privileges.

			regards, tom lane